#!/bin/bash

# ----------------------------------------------------------------------
# Filename:   restoreACL.sh
# Version:    1.0
# Date:       2013/12/02
# Author:     huijing.hei
# Email:      huijing.hei@cs2c.com.cn
# Summary:    03系统安全功能-05ACL-01命令setfacl-07命令行设置ACL属性setfacl:备份和恢复ACL属性
# Notes:       ***
# Copyright:    China Standard Software Co., Ltd.
# History：     
#             Version 1.0, 2013/12/02
#             - set directory default acl
#             - backup acl, and restore
# ----------------------------------------------------------------------
##! @TODO: setfacl
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function DoSetup()
{
    # check user is root
    IsRoot
    EchoResult "check user is root"

    trap DoCleanup INT EXIT

    CmdCheck setfacl getfacl

    TEST_USER1=testu1
    TEST_USER_PASSWORD1=setfacl123
    TEST_USER2=testu2
    TEST_USER_PASSWORD2=setfacl123
    TEST_GROUP=testg1

    TMP_DIR=/tmp/acl$$

    # set umask 022
    [ `umask` != "0022" ] && umask 022

    mkdir ${TMP_DIR}
    EchoResult "mkdir temp dir"

    id -ru ${TEST_USER1} && userdel -rf ${TEST_USER1}
    id -ru ${TEST_USER2} && userdel -rf ${TEST_USER2}

    # add group
    groupmod ${TEST_GROUP} > /dev/null 2>&1 && groupdel ${TEST_GROUP}
    groupadd ${TEST_GROUP}
    EchoResult "add group"

    # add two users
    AddUserPasswd ${TEST_USER1} ${TEST_USER_PASSWORD1} -g ${TEST_GROUP}
    EchoResult "add user ${TEST_USER1}"
    AddUserPasswd ${TEST_USER2} ${TEST_USER_PASSWORD2}
    EchoResult "add user ${TEST_USER2}"


}

##! @TODO: check user has permission to mkdir
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function CheckACL1()
{

    TEST_USER=$1
    # check nomarl user allowed to write file(root)
    TMP_DIR1=${TMP_DIR}/test
    [ -d ${TMP_DIR1} ] && rm -rf ${TMP_DIR1}
    su - ${TEST_USER} -c "mkdir -p ${TMP_DIR1}"

    if [ $? -eq 0 ];then
        echo "${TEST_USER} mkdir success"
        return 0
    else
        echo "${TEST_USER} mkdir fail"
        return 1
    fi


}

##! @TODO: set default acl
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure
function DoTest1()
{   

    # setfacl default dir
    setfacl -d --set u:${TEST_USER2}:rwx,g:${TEST_GROUP}:r-x ${TMP_DIR}
    #setfacl  -d --set u:${TEST_USER2}:rwx,g:${TEST_GROUP}:r-x ${TMP_DIR}
    EchoResult "setfacl dir"

    # getfacl
    #getfacl -p ${TMP_FILE} | grep -E "user:${TEST_USER1}:rw-|group:${TEST_GROUP}:r--"
    #getfacl -p ${TMP_DIR}
    getfacl -p ${TMP_DIR} | grep -E "default:user:testu2:rwx|default:group:testg1:r-x"
    EchoResult "getfacl"


    # setfacl -m
    setfacl -m u:${TEST_USER2}:rwx,g:${TEST_GROUP}:r-x ${TMP_DIR}
    EchoResult "setfacl -m"
    # getfacl 
    getfacl -p ${TMP_DIR}
    EchoResult "getfacl" 

    # touch temp file
    TMP_FILE=${TMP_DIR}/file
    touch ${TMP_FILE}

    # not allowed to mkdir
    ! CheckACL1 ${TEST_USER1}
    EchoResult "${TEST_USER1} not allowed to mkdir"

    ####################
    # allowed to mkdir
    CheckACL1 ${TEST_USER2}
    EchoResult "${TEST_USER2} allowed to mkdir"


}

##! @TODO: check acl restore function
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function CheckACL2()
{

    TEST_USER=$1
    # check nomarl user allowed to write file(root)
    TMP_DIR1=${TMP_DIR}/test
    chown -R root.root ${TMP_DIR1}
    EchoResult "chown root.root ${TMP_DIR1}"

    su - ${TEST_USER} -c "mkdir -p ${TMP_DIR1}/tt"

    if [ $? -eq 0 ];then
        echo "${TEST_USER} mkdir success"
        return 0
    else
        echo "${TEST_USER} mkdir fail"
        return 1
    fi


}

##! @TODO: setfacl, then backup acl, then restore acl
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure
function DoTest2()
{
    TMP_ACL=/tmp/$$.acl
    
    # backup acl
    getfacl -p -R ${TMP_DIR} > ${TMP_ACL}
    EchoResult "backup acl"

    # delete all acl
    setfacl -b -R ${TMP_DIR}
    EchoResult "clear acl"

    # getfacl
    getfacl -p ${TMP_DIR}
    EchoResult "clear acl, getfacl"

    ####################
    # check clear success
    ! CheckACL2 ${TEST_USER1}
    EchoResult "clear acl, ${TEST_USER1} not allowed to mkdir"
    ! CheckACL2 ${TEST_USER2}
    EchoResult "clear acl, ${TEST_USER2} not allowed to mkdir"

    # restore acl
    setfacl --restore ${TMP_ACL} 
    EchoResult "restore acl"

    ####################
    # not allowed to mkdir
    ! CheckACL2 ${TEST_USER1}
    EchoResult "restore acl, ${TEST_USER1} not allowed to mkdir"

    # allowed to mkdir
    CheckACL2 ${TEST_USER2}
    EchoResult "restore acl, ${TEST_USER2} allowed to mkdir"

}

##! @TODO: setfacl
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function DoCleanup()
{
    for i in ${TEST_USER1} ${TEST_USER2}; do
        id -u ${i} > /dev/null 2>&1 && userdel -r ${i}
        EchoResult "userdel ${i}"
    done
    groupdel ${TEST_GROUP}
    EchoResult "groupdel ${TEST_GROUP}"
    [ -d ${TMP_DIR} ] && rm -rf ${TMP_DIR}
    [ -f ${TMP_ACL} ] && rm -f ${TMP_ACL}
}

# include lib files

if [ -z "$SFROOT" ]
then
    echo "SFROOT is null, pls check"
    exit 1
fi

. ${SFROOT}/lib/Echo.sh
. ${SFROOT}/lib/Check.sh
. ${SFROOT}/testcases/Security/lib/UserOps.sh

export LANG=C

DoSetup
DoTest1
EchoResult "@@testcase 1/2 : set default acl"
DoTest2
EchoResult "@@testcase 2/2 : restore acl"
echo ""
